不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様18社 -
2025/05/29
※2025/05/29 更新
マルウェア感染させると考えられるURLを検知（2025/05/29）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://124[.]220[.]205[.]147:81/Tk6h hxxp://196[.]251[.]87[.]153:8080/02[.]08[.]2022[.]exe hxxp://83[.]229[.]123[.]144/02[.]08[.]2022[.]exe |
Cobalt Strike |
| URL | hxxp://185[.]156[.]72[.]2/files/5297474040/PJoZU13[.]exe | Formbook |
| URL | hxxp://185[.]156[.]72[.]2/files/1158628954/ZeGonzb[.]exe hxxps://github[.]com/RomanMus-bit/vbssss/raw/refs/heads/main/build27[.]exe |
Rhadamanthys |
| URL | hxxps://dnsg-windows-ds-data[.]live/tSs02T hxxps://adwwworks[.]com/4a3a[.]js hxxps://adwwworks[.]com/js[.]php hxxps://z98123[.]top/zfyg[.]h hxxp://z98123[.]top/12 hxxp://147[.]45[.]45[.]177/transform |
KongTuke |
| URL | hxxps://syavsp5[.]top/lsass/jsson[.]js hxxps://celebratingseniors[.]net/header[.]php hxxps://syavsp5[.]top/lsass/index[.]js hxxps://celebratingseniors[.]net/rats[.]zip hxxps://celebratingseniors[.]net/rate[.]zip hxxp://insideedgepr[.]com/cors[.]zip hxxps://celebratingseniors[.]net/oste[.]zip hxxp://www[.]insideedgepr[.]com/cors[.]zip hxxps://kaestner[.]top/ss/index[.]js hxxps://classiccolonialhomes[.]com/header[.]php hxxps://classiccolonialhomes[.]com/ksos[.]zip hxxps://naturistvenue[.]digital/EdFuAr8QxnGf/snow[.]zip hxxp://ns[.]talonexcavate[.]top/h8rEwScxPHYD[.]ps1 |
NetSupportManager RAT |
| URL | hxxp://charlie[.]yourwebsitedemos[.]com/webe/Mint-Heights/wp-content/plugins/wp-assemblage-security/index[.]php?r=bD1odHRwczovL2RxcmRidi5jb20v hxxp://verdeta[.]it/wp-content/plugins/wp-open-multinetworked/index[.]php?r=bD1odHRwczovL2RxcmRidi5jb20v hxxps://prot12-05[.]com/work/ hxxps://pros0512[.]com/work/ |
Latrodectus |
| URL | hxxp://5[.]252[.]155[.]213/43d10964878dfc17[.]php | Stealc |
| URL | hxxps://wa[.]fedor-turin[.]ru/login hxxps://www[.]owa[.]fedor-turin[.]ru/login hxxps://www[.]wa[.]fedor-turin[.]ru/login hxxps://www[.]autodiscover[.]fedor-turin[.]ru/login hxxp://195[.]182[.]25[.]71:423/b |
Lumma Stealer |
| URL | hxxp://94[.]159[.]105[.]149/12345[.]txt | Vidar |
| URL | hxxps://bitcointransfers[.]net/transaction2371[.]html hxxps://bitcointransfers[.]net/robot-checker |
Havoc |
| URL | hxxp://87[.]121[.]84[.]163/mipsel hxxp://87[.]121[.]84[.]163/x86 hxxp://87[.]121[.]84[.]163/arm6 hxxp://87[.]121[.]84[.]163/mips hxxp://87[.]121[.]84[.]163/arm hxxp://87[.]121[.]84[.]163/spc hxxp://87[.]121[.]84[.]163/arm5 hxxp://87[.]121[.]84[.]163/i686 hxxp://87[.]121[.]84[.]163/x86_64 hxxp://87[.]121[.]84[.]163/arm7 hxxp://87[.]121[.]84[.]163/sh4 hxxp://87[.]121[.]84[.]163/m68k |
Bashlite |
| URL | hxxps://api[.]telegram[.]org/bot7757793052:AAGqekekJBAEvXVPqSiM-h_KeWaoCMHTDmk/sendMessage?chat_id=8063867525 | Snake Keylogger |
| URL | hxxps://promo[.]summat10n[.]org/azEUdRATdxwPEy5HXAY4VxkTLlcGVmUHDkNuDBFdeAEHSDYI hxxps://feedback[.]jjsbootjack[.]com/profileLayout |
FAKEUPDATES |
| URL | hxxp://h4[.]residue-player[.]world/shark2[.]bin hxxps://h4[.]residue-player[.]world/shark[.]bin |
Shark |
| URL | hxxps://mi[.]citationcompany[.]bet/systemenv[.]bin | Amadey |
| URL | hxxp://167472cm[.]nyashru[.]ru/nyashsupport[.]php | DCRat |
| URL | hxxp://45[.]51[.]173[.]135:48712/Mozi[.]m | Mozi |
| URL | hxxps://github[.]com/s7bhme/adadsadsadsa/raw/refs/heads/main/x69m5tl[.]exe | XWorm |
